CVE-1999-0864: High severity SCO UnixWare vulnerability
UnixWare programs that dump core allow a local user to modify files via a symlink attack on the ./core.pid file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable core dumps for affected programs (so they do not create ./core.pid). For example, set per-service or system ulimit for core size to 0 or otherwise configure the OS/service to prevent core file generation for programs accessible to unprivileged users.
Xinuos UnixWare core dumps = disabled - Configuration
Ensure programs that may produce core files are not run from directories writable by local unprivileged users. Adjust ownership and permissions (or ACLs) on those directories so local users cannot create or replace ./core.pid via symlink.
UnixWare program working directories directory writable by unprivileged users = not writable - Compensating control
If you cannot immediately disable core dumps or fix directory permissions, restrict local user write access to locations where vulnerable programs run (using filesystem permissions, ACLs, or mounting with restrictive options) to prevent creation of malicious symlinks to ./core.pid.
- Operational
Search for existing ./core.pid files or symlinks created by unprivileged users and remove or replace any unsafe symlinks with secure files. Correct ownership/permissions of any recovered files to prevent future symlink attacks.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0864?
CVE-1999-0864 is considered a moderate severity vulnerability that allows local users to exploit symlink attacks.
How do I fix CVE-1999-0864?
To fix CVE-1999-0864, ensure proper file permissions are set to prevent unauthorized access to core dump files.
Which versions of UnixWare are affected by CVE-1999-0864?
CVE-1999-0864 affects UnixWare versions 7.0, 7.0.1, 7.1, and 7.1.1.
What types of attacks are possible due to CVE-1999-0864?
CVE-1999-0864 allows local users to modify files through a symlink attack targeting the ./core.pid file.
Is there a patch available for CVE-1999-0864?
There is no specific patch for CVE-1999-0864; however, applying security best practices can mitigate the risk.